5

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been trying both of those, and they are so much more convenient, but I do worry about how vulnerable they may be to attack.

I know these solutions talk of end-to-end encryption as a way of ensuring security, and I think I understand that in principle, but don't know enough about it to assess how foolproof it really is. I know they keep a copy of my password database on the cloud, but then I do that anyway by having my KeePass database file on cloud storage. Maybe the difference is that both the cloud storage password and the database password would be required to access my KP DB, but only one set of credentials would be required to access my Lastpass account (for example)? I've seen suggestions that if Lastpass (et al) were hacked, the data would be useless as it's all encrypted - is it really as straightforward as that?

The other consideration for me is that I like to maintain versioned backups of my KP DB, so not only do I have a local backup of the whole DB, but I can roll back to several versions ago if I realise there's an integrity problem with the DB. I don't know any (automated) way of doing that with Lastpass or Bitwarden (though I have only tried the free versions thus far).

I would be interested to get some views from people who are better versed in security matters than I am - at the moment I'm very tempted by the convenience of a cloud solution (with native Android app and Firefox & Chrome integration) but just can't decide if it's really a good idea (though I know millions of people have depended on them for a long time!).

p.s. have just seen something called KeeWeb which looks like some sort of KeePass-cloud hybrid, so I will be looking into that with interest!

Improve this question
3
  • 1
    I don't know what "ropey" means, but I share your concerns about cloud based password managers' security. However, my reasons come from "supply chain security" -- imagine someone doing to Bitwarden what they did to Solarwinds, and manipulate it to send the plain text to a server of their choice by subverting the existing cloud-store function. Standalone apps like KeepassXC don't have a "store to cloud" feature to subvert, so a hack is much harder. And worst case we can run them with network access disabled -- they really don't need it anyway.
    – user88917
    Jan 1, 2021 at 12:32
  • @sitaram Thank you, that's a useful perspective. And sorry for the obscure bit of language (en-GB)... collinsdictionary.com/dictionary/english/ropey
    – Chas
    Jan 2, 2021 at 20:11
  • thanks... I should have looked it up. I knew "dodgy", but this was new to me :)
    – user88917
    Jan 9, 2021 at 5:16

1 Answer 1

Reset to default
2

One possible problem with online password managers is that your adversary could guess passwords to the password manager from anywhere in the world, while you need to have physical access to brute force on a local password manager. Also, if the KeePass DB is in cloud storage, the adversary needs to get the password to the cloud storage.

Improve this answer
16
  • 1
    I'm pretty sure cloud-based password managers implement some sort of rate limiting, so you shouldn't be able to bruteforce it from anywhere in the world, unless you hack into the service to obtain a copy of the password databases.
    – nobody
    Dec 28, 2020 at 17:52
  • 3
    However, if you have a bad password or reused password for your password manager, it's easier to hack cloud based than local
    – Heng Ye
    Dec 28, 2020 at 18:07
  • @HengYe what do you base that assumption on? Do you think that the average user is better at securing (patching, mitigating phishing attacks etc.) their endpoints than a online password manager (cloud service)? I'm not pro on or the other but I think you comment lacks depth. Multiple modern online password managers enables usage of multifactor authentication, strict access control etc. I would propose to you to read up on the 1Password security model as a good example - 1password.com/files/1Password-White-Paper.pdf
    – Kristian Bodeholt
    Dec 28, 2020 at 18:21
  • @KristianBodeholt Yes, users should enable multi-factor authentication to make it more secure, but I don't think that's by default.
    – Heng Ye
    Dec 28, 2020 at 20:08
  • @KristianBodeholt For example, if you're using password123 as your KeePassXC password, adversary also need the database file while in a remote password manager just need username and password.
    – Heng Ye
    Dec 28, 2020 at 20:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .